Executive brief
Podlove Podcast Publisher is a WordPress plugin that manages podcast distribution and metadata. The plugin is vulnerable to stored cross-site scripting (XSS) attacks through contributor comment fields, allowing authenticated contributors to inject malicious scripts that execute for all users viewing podcast episode pages. An attacker can exploit this to steal user sessions, spread malware, or deface content without direct user interaction.
Technical details
The vulnerability is a stored XSS flaw in the contributor comment parameter ('episode_contributor[..][..][comment]') caused by insufficient input sanitization and output escaping. The vulnerable code saves contributor comments directly to a custom database table, bypassing WordPress's standard wp_kses_post filter, and the save_post hook lacks nonce verification. Any authenticated user with contributor-level access or above can inject arbitrary JavaScript that persists in the database and executes in the browser context of subsequent visitors. The vulnerability affects all versions up to and including 4.5.5; patches are likely available in newer releases.
Affected products
- Podlove Podcast Publisher up to 4.5.5
Timeline
- 2026-09-09: disclosed